Snort mailing list archives
Re: Snort Rule Advise.
From: Paul Schmehl <pauls () utdallas edu>
Date: Fri, 13 Apr 2007 10:24:11 -0500
--On Friday, April 13, 2007 15:00:33 +0100 Tony Purdy <tpurdy () axial co uk> wrote:
The problem is, you can't restrict the rule to ADS unless you use pcre and anchor the expression on both sides. If all you look for is ADS, you're going to see it anywhere there's a word that contains ADS in it. And you're using nocase, so it's going to alert on anything with Ads, ADs, aDs, aDS, ads, etc.Could someone kindly advise if it is possible to achieve the following within a rule. I am creating rules to trigger when specific words are seen within the payload, for example the word ‘ADS’ as below: alert tcp any any -> any any (msg :"SecureADS"; sid:1000011; content:"ADS"; nocase; rev:1;) But currently it will trigger if it sees NADS for example which is a menu option within an SGD environment. Please advise how I can restrict the rule to trigger when only ADS is seen, this can appear anywhere in the payload.
First you need to tell us exactly what it is you want to alert on. If it's ADS and *only* ADS, then you could do something like this:
alert tcp any any -> any any (msg: "SecureADS"; content:"ADS"; pcre:"/^ADS$/"; sid:1000011; rev:1;)
If you're really trying to alert on SecureADS, then you could probably get away with only content, since that's unlikely to match anything else.
alert tcp any any -> any any (msg: "SecureADS"; content:"SecureADS"; sid:1000011; rev:1;)
But, if you really want useful advice, you need to be more specific. If you have a packet dump you can share, that would help a lot.
Paul Schmehl (pauls () utdallas edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Attachment:
_bin
Description:
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort Rule Advise. Tony Purdy (Apr 13)
- Re: Snort Rule Advise. Matt Jonkman (Apr 13)
- Re: Snort Rule Advise. Paul Schmehl (Apr 13)